PKCE Bypass in Lemonldap::NG::Portal by OW2

CVE-2026-92289

What is CVE-2026-92289?

A vulnerability in Lemonldap::NG::Portal versions prior to 2.23.4 allows for a PKCE bypass when used in 'PKCE or secret' mode. The weakness arises because the function checkEndPointAuthenticationCredentials does not properly verify the client secret for public Relying Parties. As a result, attackers can intercept authorization codes issued to these parties and exchange them for access, ID, and refresh tokens without the proper validation of a code challenge. This allows unauthorized access by replaying the client_id with an arbitrary secret, effectively undermining the security mechanism that PKCE is designed to enforce.

References